CVE-2020-8421

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in comactionlogs...

CVE-2020-13761

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

CVE-2020-11889

An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of comusers allow the unauthorized deletion of usergroups...

CVE-2020-19447

SQL injection exists in the jdownloads 3.2.63 component for Joomla! comjdownloads/models/send.php via the fmarkedfilesid parameter...

CVE-2020-15697

An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users...

CVE-2020-11890

An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration...

CVE-2010-2515

Multiple SQL injection vulnerabilities in index.php in the JFaq comjfaq component 1.2 for Joomla!, when magicquotesgpc is disabled, allow 1 remote attackers to execute arbitrary SQL commands via the id parameter, and 2 remote authenticated users with "Public Front-end" permissions to execute...

CVE-2012-4235

The RSGallery2 comrsgallery2 component before 3.2.0 for Joomla! 2.5.x does not place index.html files in image directories, which allows remote attackers to list image filenames via a request for a directory URI...

CVE-2011-5113

SQL injection vulnerability in frontend/models/techfoliodetail.php in Techfolio comtechfolio component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter...

CVE-2014-7982

Cross-site scripting XSS vulnerability in Joomla! CMS 2.5.x before 2.5.19 and 3.x before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-3422

SQL injection vulnerability in the JGen comjgen component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php...

CVE-2010-4898

SQL injection vulnerability in the Gantry comgantry component 3.0.10 for Joomla! allows remote attackers to execute arbitrary SQL commands via the moduleid parameter to index.php...

CVE-2010-4720

SQL injection vulnerability in the JExtensions JE Auto comjeauto component before 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to the view item page...

CVE-2011-4907

Joomla! 1.5x through 1.5.12: Missing JEXEC Check...

CVE-2011-4829

SQL injection vulnerability in the comlisting component in Barter Sites component 1.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the categoryid parameter to index.php...

BIT-JOOMLA-2023-23755 [20230502] - Core - Bruteforce prevention within the mfa screen

An issue was discovered in Joomla! 4.2.0 through 4.3.1. The lack of rate limiting allowed brute force attacks against MFA methods...

BIT-JOOMLA-2022-27913 [20221002] - Core - RXSS through reflection of user input in headings

An issue was discovered in Joomla! 4.2.0 through 4.2.3. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components...

BIT-JOOMLA-2022-27912 [20221001] - Core - Debug Mode leaks full request payloads including passwords

An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous requests...

BIT-JOOMLA-2022-27911 [20220801] - Core - Multiple Full Path Disclosures because of missing '_JEXEC or die check'

An issue was discovered in Joomla! 4.2.0. Multiple Full Path Disclosures because of missing 'JEXEC or die check' caused by the PSR12 changes...

BIT-JOOMLA-2022-23798 [20220306] - Core - Inadequate validation of internal URLs

An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not...